Understanding In-Place Hold and Litigation Hold in Exchange

In today’s Ask the Admin, I’ll explain the differences between Exchange In-Place Hold and Litigation Hold.

What Is A Litigation Hold?

Litigation Hold was first introduced in Exchange 2010 and is designed to preserve all items in a mailbox indefinitely for the purposes of e-discovery. Litigation Hold can be applied to mailboxes or distribution groups. When a user’s mailbox is put on Litigation Hold, they are still able to delete items, but Exchange retains the deleted items indefinitely with immutability. For example, if the user changes an item, it will remain preserved in its original form.

While initially designed for e-discovery purposes in legal cases, Litigation Hold can also be used for archiving in other scenarios. The ability to define a hold period was added to Exchange Online in the form of the LitigationHoldDuration parameter, which allows you to set a retention period. This ability was later added to Exchange 2013.

To put all mailboxes on Litigation Hold for seven years (2555 days), use the PowerShell code below. For more information on using PowerShell with Exchange Online, see “How to Connect to Exchange Online with PowerShell” on Petri.

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -LitigationHoldEnabled $true -LitigationHoldDuration 2555

Litigation Hold and In-Place Hold objects can also be created using the Exchange Admin Center (EAC).

What Is An In-Place Hold?

In-Place Hold was introduced in Exchange 2013 and is also available in Exchange Online. Although similar, In-Place Hold doesn’t replace Litigation Hold and both are valid solutions in different scenarios. There are two ways that In-Place Hold can be applied.

Query-based In-Place Hold does exactly what it says on the tin and allows administrators to preserve items based on queries. Naturally the key advantage of this is cost, enabling organizations with on-premise Exchange to preserve specific items rather than entire mailboxes.

The PowerShell code below creates a new In-Place Hold object (InPlaceHold-Finance) and applies it to mailboxes in the DG-Finance distribution group. Items are preserved for seven years and a filter is applied using Boolean logic and a proximity operator (NEAR) to search for items that contain the word Toy, Toymaker, or anything similar, within three words of Acme, and that have Confidential or Privileged included.

New-MailboxSearch ‘InPlaceHold-Finance’ -SourceMailboxes DG-Finance -InPlaceHoldEnabled $true -ItemHoldPeriod 2555 -SearchQuery “(Acme NEAR(3) Toy*) AND (Confidential OR Privileged)”

Time-based In-Place Hold objects replicate the functionality of Litigation Hold and allow items to either be preserved indefinitely or for a specific period. Omitting the -ItemHoldPeriod parameter sets items to be preserved indefinitely. It’s also possible to add the -StartDate and -EndDate parameters to the New-MailboxSearch cmdlet.

In-Place Hold supports Public Folders for the first time in Exchange 2016. Additionally, In-Place eDiscovery, which gives users the ability to perform searches across all items including those placed on hold, can now run queries against all mailboxes simultaneously.

FAQ

What are the compliance requirements for implementing a litigation hold or in-place hold in Office 365?

Organizations must have appropriate licensing levels (typically E3 or E5) to use litigation hold or in-place hold features. Compliance officers need specific admin roles assigned, and organizations should maintain detailed documentation of hold implementations to meet regulatory requirements.

Can litigation hold or in-place hold be applied to specific file types or locations?

Both litigation hold and in-place hold can be applied to various content types including emails, attachments, calendar items, and Teams messages. Additionally, in-place hold can target specific SharePoint sites and OneDrive locations.

What happens when a user leaves the organization during an active litigation hold or in-place hold?

When an employee departs, their mailbox can be converted to an inactive mailbox while maintaining the litigation hold or in-place hold. The content remains preserved and searchable for compliance purposes.

How do litigation hold or in-place hold affect storage capacity and performance?

Both litigation hold and in-place hold impact storage usage as they preserve multiple versions of items. Organizations should monitor storage consumption and plan accordingly, especially for long-term holds across multiple mailboxes.

What are the notification requirements when implementing litigation hold or in-place hold?

While not technically required, best practices suggest informing affected users when their content is placed under litigation hold or in-place hold. Organizations should have clear communication policies and consider implementing automated notifications.